Min Xiao, OSP

1
HMS Audit TrainingJune 3, 2005

• Min Xiao, OSP
• Gail McDermott, RMAS
• Greg Murray, RMAS
• Miriam Vazquez, RMAS
• Sarah T. Axelrod, FOA

2
Agenda

• Introduction
• Types of Audits
• Preparation for Audits
• Tools
• Case Study
• Summary

3
Introduction

• Explain why these various audits happen, and how
  frequently we can expect them to occur
• Describe how you can prepare for the audits in a
  proactive way rather than reactive
• Highlight the tools available here at HMS to
  survive the audits
• Emphasize the partnership of the various service
  offices who are here to protect the interest of
  faculty and administrators, HMS, and HU.

4
Types of Audits

• Internal Audits (RMAS)
• Compliance Audits (A 133)
• Federal Audits
• FA (Indirect Cost) Audits
• Agency Audits
• Not for Case Audits

5
RMAS Mission Statement

• Provide an independent, objective assurance and
  consulting service which is used within Harvard
  as an integral part of its risk management and
  control processes
• Help the University accomplish its objectives
  by bringing a systematic disciplined approach to
  evaluate and improve the effectiveness of risk
  management and control processes

6
Services and Types of Audits

• Financial Operational Audits
• Compliance Audits
• Information Systems
• Special Projects/Consulting
• Investigations
• Post Audit Appraisals (PAA)
• Training

7
Why Audits

• Part of Risk Management Internal Control
  Processes
• Independent, objective assurance that risks are
  being managed in a cost effective manner
• Recommend changes to improve risk management

8
What is Risk?

• Anything that does not allow an organization to
  achieve its objectives
• Risk is inherent in any business.
• Example of risk unallowable and unallocable
  spending on an award causing sponsor to curtail
  future monies.
• Risk assessment considers
• Likelihood of an event occurring
• Impact should the event occur
• Risk assessment leads to risk management

9
What is risk (cont.)

• External risk such as
• Economic changes
• Natural disasters
• Changes to Federal regulations
• Internal risk such as
• New systems
• Untrained personnel
• Unexpected turnover
• Fraud

10
Internal Controls

• A process designed to provide reasonable
  assurance objectives are achieved
• Operational Objectives efficient and effective
  operations, safeguarding of assets, HR practices
  to hire quality personnel
• Reporting Objectives- Accurate and complete
  financial reports
• Compliance Objectives compliance with all
  legal, regulatory and policy requirements
• Example
• Approval of web vouchers separate from person
  doing the transaction
• Monthly review of detailed listings
• Approval of effort reports

11
Components of Internal Control

• There are five interrelated components of
  internal control derived from basic operations
  and administrative processes. The control
  environment is at the bottom because it is the
  foundation for all the others.

12
How Do We Determine What to audit?

• Annual evaluation based on RMAS risk assessment
  process
• Management input on concerns
• Audit results internal external
• Changes to operations including new systems
• Regulatory Agency focus
• Events at other Universities
• JCI observations
• Emerging issues

13
FY06 Risk Activities

• Stem Cell Research
• International Operations
• Student Travel Abroad
• Cross Faculty Initiatives
• Business Continuity Planning
• Information Systems Security
• Technology Transfer Licensing
• Construction

14
How do we determine where to audit

• Risk assessment results
• Activities to audit
• Groups that perform those activities
• Other factors such as
• Size, volume or complexity of activity
• Date of last audit
• University coverage
• Management request

15
When will you know you are to be audited?

• Routine audit-
• Audit plan is completed in the summer of the
  fiscal year
• Audit plan is shared with schools in the fall
• PAAs
• At time initial audit is complete
• Special Projects
• When you ask

16
Audit Approach

• Understand the operations including risks
• Understand business processes and risk mitigating
  approach
• Determine audit scope agree with management
• Focus is on internal controls
• What is in place to manage the operational and
  financial risks e.g. policies, review approval
  practices, management and financial reports,
  monitoring, system controls and access
  privileges etc.
• Are the controls working effectively
• Testing
• Analytical review
• Trends
• Audit Report Process

17
Common Activities in an Audit

• Tone at the top
• Budgeting and Management Reporting
• HR processes e.g. hiring and performance review
  practices
• International Operations
• Transaction Processing and Approval
• Web Voucher, Pcard, Payroll

• Post Award Management
• Allocable costs, award terms and conditions
• Effort reporting and cost transfers
• Service Centers
• Costs, billing and rates
• Vendor management including use of contracts
• Cash and receivable processing

18
WHATis A-133?

• An Office of Management and Budget (OMB) Circular
  requiring an annual external audit of non-profits
  receiving federal funds for sponsored programs in
  excess of 500k (as of 12/31/03)
• Sample of federal awards their direct cost
  transactions are selected for audit to determine
  if expenditures and procedures were appropriate
  according to the federal guidelines, sponsor
  terms/conditions University policies

19
WHAT IS A-133 ?

• Other testing includes
• effort reporting
• internal control testing
• cost transfers
• program income
• equipment testing
• financial non-financial reporting
• sub-recipient monitoring
• service centers
• student financial aid
• FA rate application

20
A133 Audit Process

• A-133 audit process involves the following
• External groups PricewaterhouseCoopers (PWC) and
  federal government
• Internal groups schools, OSP, RMAS, Office of
  General Counsel, VP Finance
• FOA is HMSs local liaison for the A-133 audit
• OSP coordinates the audit with PWC auditors and
  works with school liaisons for audit resolution

21
A133 Audit Schedule

• May - June The planning audit selection
• July The Orientation begins with PWC, OSP, and
  departments
• August - September PWC auditors perform direct
  cost compliance testing, includes interview PI
  and grant administrators
• October - November OSP and RMAS work with PWC
  and departments to clear findings before report
  is finalized
• December - January PWC issues a final report
  the schools submit a corrective action plan

22
Why Me?

• A-133 Audit departments are selected with the
  following criteria in mind
• Total Department Federal Dollars by audit year
• Frequency of the last A-133 audit
• Departments are rotated, as are some schools with
  fewer federal dollars
• HMS is ALWAYS selected because it has the top
  federal ( HMS comprises 40 of the total
  sponsored expenditures in FY04 ( 238M )
• The award types and research locations
• Rotation of service centers
• High risk area that are determined by PWC ( e.g.
  PEPFAR, Broad Institute, Stem Cell Research )

23
WHYdo we care?

• All Federal and increasingly more non-federal
  sponsors look at A-133 as a report card of how
  we spend their money
• Findings are reported to federal government and
  become public record, distributed to all federal
  agencies through a clearing house
• Harvards reports can be found at
• http//vpf-web.harvard.edu/osp/support/sup_osp_aud
  .shtml
• Each department performing sponsored research is
  accountable for demonstrating that the reported
  expenditures are appropriate with the terms and
  conditions of the award and federal costs
  principles ( A-21, A-110)

24
WHAT are the auditors looking for?

• Costs incurred for the same purpose in like
  circumstances should be treated consistently as
  either direct or as facilities and administrative
  costs
• Exceptions of different purpose and circumstance
  need to be documented
• Allowability and allocability of expenses
• Costs identified specifically with a particular
  sponsored project/activity, or can be directly
  assigned to such activity relatively easily with
  a high degree of accuracy
• Documentation completed at the time of
  transaction processing

25
Common A-133 Findings

• Unallowable costs charged to grants
• Sales tax, travel expenses, office supplies
• Timely and Accurate Annual Financial Reporting
• 90 calendar days after the end of the grant year
• In FY 04, 7 reports were late out of a selection
  of 60
• Timely and signed Effort Reporting
• Evidence of timely review by someone with
  first-hand knowledge
• Cost Transfers
• Timeliness, justification, authorization

26
Federal Audits

• F A Audit
• Agency Audits

27
F A Audit

• What
• DHHS audit of the HMS proposed FA (indirect
  cost) rate
• Why
• To test/verify HMSs data that supports the
  proposed FA rate
• Who
• 2 staff from the NY DHHS office
• When
• HMS submits a rate proposal every 4 years
• DHHS auditors spend approximately one week on
  campus

28
F A Audit - Cycle

• Prepare for base year (1/04-6/04)
• Base Year (7/04-6/05)
• Analysis and Proposal Preparation (7/05-1/06)
• DHHS Desk Review (Winter to Spring 06)
• DHHS Field Audit (Spring 1 week)
• Requests for additional information (Spring 06)
• Negotiation Session in NY (Summer 06)
• Effective dates of negotiated rates (AY 07 AY
  10)
• Next base year (AY 09 starts 7/1/08)

29
F A Audits

• What is the audit focus
• Space
• General Ledger coding
• Facilities Costs
• Library Costs
• Allocations

30
FA Audits Departmental Involvement

• How are departments involved?
• In June 2002 DHHS visited 4 departments and met
  with 3 PIs in each department
• Reviewed payroll detail for the 4 departments
• Auditor walked the space
• Interviewed each PI
• Physically inventoried all equipment listed as
  located within these labs

31
FA Audits Other Data Requests

• Sample of other information the auditors
  requested?
• Departmental space
• Room by room breakdown of the functionalization
  of space for the 4 departments reviewed
• OM salary and cost details
• Specific questions relating to library costs

32
FA Audits Other Data Requests

• Sample of other information the auditors
  requested (continued)?
• Cost sharing detail
• Equipment location
• Documentation regarding expense reclassification
• Other occupants in research labs (visiting
  professors, students, admin staff)

33
What to do to Prepare for an Audit?

• Operations Self-Assessment
• Continuously Assess your Business Processes
• Very often what you are worried about represents
  a control weakness
• Practice Fiduciary Responsibility
• Keep abreast of
• HMS/University Policies
• Award Terms and Conditions
• System capabilities
• Regulatory changes
• Document Transactions
• Business purpose who, what, when, where, why
• Basis for allocating costs among awards
• Reason for journal entries
• Review Financial Reports
• The Devil is in the details

34
Tools Available for Survival

• Training
• HMS Aspire sessions, HU sessions, external
  (NCURA, SRA, RADG)
• Network
• SPA, OSP, FOA, ORC, peers in other departments
• Policies
• HMS, HU, Federal
• Websites
• E-commons (FOA, OSP, H/R), SPA, OSP, ABLE, other
  schools, government agency sites
• Data
• Financial, sponsored (GMAS, HMS SPAR), Peopleview

35
Tools Available for Survival

• Key data/reports for proactive reviews
• PERs
• Detail listings
• E-tads and Peopleview
• Key policies for grants management
• HMS Sponsored expenditure policy
• Cost transfer policy
• Financial management guide to policies,
  procedures and best practices

36
Tools Available for Survival

• ASK QUESTIONS!
• Do not assume that how something has always
  been done is the only way or the correct way

37
Case Study - One

• Sara, is the grants coordinator who is managing
  10 grants ( 7 federal, 3 non-federal ) for
  several PIs in the department. When she tries
  to approach the PIs for assistance on the
  allocation of lab supplies costs, they are often
  out of the town or too busy for these matter. So
  Sara developed a strategy to allocate all costs
  first on to the federal grants, but with the
  intention of journaling out portion of costs
  later when she can figure out how much should be
  re-allocated to non-federal grants. Sara thinks
  this is a better approach because a 90 days cost
  transfer policy does not apply to journals
  transferring costs from federal grants to
  non-federal grants.
• One day she received a call from OSP and learned
  that one of her federal grants has been selected
  by PWC for the annual A-133 audit.

38
Case Study - Two

• Dr. Globe made his own flight arrangements for a
  trip to conferences in Washington DC. His travel
  expenses were selected for an A-133 audit, by now
  though, Dr. Globe had left Harvard for a west
  coast institution.
• David, the Harvard department administrator,
  contacted Dr. Globe and asked him to document how
  he had selected the lowest available fares for
  his journey. He emailed in response that he
  booked airfares through Travelocity.Com because
  it was the lowest airfares he could find at the
  time. But he didnt keep any documentation to
  support his claim.
• What should David do now ?

39
Questions? Comments?